Vmware, Inc.

Airwatch LLC

Omnissa, LLC

Varun Murthy

Shravan Shantharam

Kalyan Regula

Jason Roszak

Blake Ryan Watts

Craig Farley Newell

Yogesh Govind Hande

Bhuvanesh Shanmuga Sundaram

Jonathon Deriso

Erich Peter Stuntebeck

Matthew Conover

Vijay Chari Narayan

Mohan Guttikonda

Nishita Manjunath

Saransh Bhatnagar

Arvind Ahuja

Achyutha Bharadwaj

Abheesh Kumar Thaleppady

Jonathan Blake Brannon

Scott Harlow Kelley

Nitin Rao

Josue Negron

Raymond Welch

Nitin Radhakrishna Rao

Scott Kelley

Disclosed are various implementations for distributing and installing packages in response to user logon events. A logon event associated with a user account is detected for a client device. A query containing a respective user account identifier is sent to a provisioning service to retrieve a set of packages to install on the client device. The set of packages are received from the provisioning service and installed on the client device.

Package distribution and installation in response to user logon

Various examples are described for operating system update management. In some examples, an OS update schedule is generated. The OS update schedule specifies an OS update for a plurality of client devices. A command to deploy the OS update is transmitted to a subset of the client devices. Behavior data is received from the client devices that have applied the OS update. An update incompatibility identified using the behavior data. Instructions to fix the update incompatibility are transmitted to certain client devices.

Operating system update management

Disclosed are various approaches to automate vulnerability assessment implement policy-based mitigation. A plurality of vulnerability records from respective ones of a plurality of vulnerability feeds are aggregated. Each of the plurality of vulnerability records are stored in a standardized format. A plurality of enterprise-specific severity scores are generated by calculating an enterprise-specific severity score for each of the plurality of vulnerability records. Then, a web page can be created that includes at least a subset of the plurality of enterprise-specific severity scores and respective ones of the plurality of vulnerability records.

Automated vulnerability assessment with policy-based mitigation

Various examples for managing a client device having multiple enrolled user accounts thereon are described. A computing device is directed to store a mapping of a client device to a plurality of user accounts active. The computing device communicates remotely with a management application on the client device to identify an active one of the user accounts from an operating system of the client device. In response to receipt of information associated with a first one of the user accounts active on the client device, the computing device enrolls the first one of the user accounts with a management service in association with the client device. In response to receipt of information associated with a second one of the user accounts active on the client device, the computing device enrolls the second one of the user accounts with the management service in association with the client device.

Co-existence of management applications and multiple user device management

Disclosed are approaches for enforcement of updates for devices unassociated with a domain or directory service. An application executing on a client device can determine that the client device is to use a locator specified in a policy to receive and install updates to software installed on the client device. The application determines whether the client device complies with the policy based at least in part on a value of a registry key stored on the client device. The application then modifies a value of a registry key stored on the client device in an instance in which it is determined that the client device is to use the locator and that the client device does not comply with the policy.

Enforcement of updates for devices unassociated with a directory service

Disclosed are various examples for enrolling a client device and synchronizing user attributes for the client device across multiple directory services. A search request for user attributes can be sent to a first directory service with an identifier for a user account. The first directory service can query for the identifier and send back user attributes. If a global identifier is included in the attributes, another search request for user attributes can be sent to a second directory service with the global identifier. The second directory service can query for the global identifier and send back user attributes.

Directory service user synchronization

Systems and methods are included for causing a computing device to assemble and boot from a managed operating system. When the computing device is powered on, it can execute firmware that specifies a server to contact. The server can identify an operating system (OS) to boot, and the location of a pre-enrollment installer for assembling the OS image. The pre-enrollment installer can download base OS images in one or more pieces from multiple locations determined based on ownership information of the computing device. The multiple OS images can relate to enterprise management and company-specific applications and drivers. Once the pre-enrollment installer has combined the base OS images, the computing device reboots using the combined OS image.

Configuring a computing device using managed operating system images

Various examples are described for operating system update management. In some examples, an OS update schedule is generated. The OS update schedule specifies an OS update for a plurality of client devices. A command to deploy the OS update is transmitted to a subset of the client devices. Update behavior data is received from the client devices that have applied the OS update. An analysis of the update behavior data correlates an update incompatibility with the OS update. The OS update is prevented from being deployed to additional client devices specified in the OS update schedule.

Various examples for providing a dynamic runtime interface for device management are described. In one example, a computing environment can access metadata that describes a configuration of a user interface made in a profile template designer application. The computing environment can identify a request for a profile creator that provides at least one setting for a desired configuration of a client device enrolled with a management service, and, in response to the request being identified, dynamically generate the user interface using the metadata, where the user interface includes a configured to receive the at least one setting for the desired configuration of the client device. The computing environment can generate a configuration profile accessible by the client device that causes an agent application executable on the client device to configure the client device in accordance with the configuration profile.

Dynamic runtime interface for device management

Operating system update management for enrolled devices is disclosed according to various examples. In one example, a computing environment can publish, to an agent application on a client device, a deployment profile with a setting that specifies a restriction associated with download or installation of software updates by a subset of client devices that includes the client device. The computing environment can receive, from the agent application, an identification of a software update available for the client device. The computing environment can receive a specification of the subset of client devices to apply the software update. In response to a predefined interaction being performed, for example, by an administrator, the computing environment can direct at least one client device in the subset to install the software update.

Operating system update management for enrolled devices

Disclosed are approaches for enforcement of updates for devices unassociated with a directory service. An application executing on a computing device can determine, based on a policy received from a management service, that the computing device is to use an update service specified in the policy to receive updates. The application then modifies a setting of the computing device to specify the use of the update service by the computing device.

Various examples for performing automated enrollments of client devices with a management service after being accessed by a staging user account are described. A client device can be configured to identify a user account active on the client device and determine whether the user account is a staging user account or an end user account associated with an intended recipient of the client device. In an instance in which the user account is the staging user account, the client device can create an event listener on the client device that monitors a subsequent login of a user account performed through an operating system of the client device, the subsequent login of the user account being the end user account. In an instance in which the subsequent login of the user account is detected by the event listener, the client device can perform an automated enrollment with a remote management service.

Growing community of inventors

Atlanta, GA, United States of America

Varun Murthy